Documentation Index
Fetch the complete documentation index at: https://code.dcycle.io/llms.txt
Use this file to discover all available pages before exploring further.
Security & Compliance
Dcycle is designed for enterprise sustainability data management. This page covers how we protect your data, manage access, and handle security across the platform and API.API Key Security
Creation, storage, rotation, and revocation
Data Protection
Encryption, residency, and GDPR compliance
Logging & Access
Audit trails, access control, and monitoring
API Key Lifecycle
API keys are the primary credential for programmatic access to Dcycle. For step-by-step instructions on creating and using API keys, see Authentication.| Phase | What Happens |
|---|---|
| Creation | Generated via Dcycle web UI, bound to the creating user |
| Storage | Stored in an encrypted PostgreSQL database (AWS RDS, AES-256) |
| Protection | All communication over TLS 1.2+ (HTTPS enforced) |
| Rotation | Create a new key, migrate integrations, revoke the old one |
| Revocation | Immediate via the UI — all requests with that key return 401 |
Creation
Creation
API keys are generated from the Dcycle web application under Settings > API Keys. Each key is bound to the user who created it — all data uploaded with that key is attributed to that user for audit and compliance purposes.Keys are displayed once at creation time and cannot be retrieved afterward. You can name keys descriptively (e.g., “Production ETL Pipeline”) to track their purpose.How to create an API key →
Server-side storage
Server-side storage
API keys are stored in an encrypted PostgreSQL database hosted on AWS RDS with encryption at rest enabled (AES-256). Only a key prefix is displayed in the management UI after initial creation.The database is deployed in a private VPC subnet with no public internet access. Access is restricted to application servers via security groups.
Protection in transit
Protection in transit
All API communication uses TLS 1.2+ (HTTPS enforced). HTTP requests are rejected at the load balancer level.API keys are transmitted in request headers (
x-api-key) over encrypted connections. We recommend storing keys in environment variables or secret managers — never in source code or version control.Security best practices →Rotation
Rotation
We recommend rotating API keys every 3-6 months. The rotation process requires no downtime:
- Generate a new API key
- Update your integrations to use the new key
- Verify the new key works correctly
- Revoke the old key
Revocation
Revocation
API keys can be revoked immediately from the management UI (Settings > API Keys). Once revoked, all requests using that key return
401 Unauthorized instantly. This action cannot be undone.How to revoke an API key →Data Protection
Encryption in Transit
TLS 1.2+ enforced on all endpoints. HTTP connections are rejected. All data between your systems and Dcycle is encrypted end-to-end.
Encryption at Rest
AES-256 encryption via AWS RDS for all database storage. S3 buckets use server-side encryption (SSE-S3/SSE-KMS) for uploaded files.
Data Residency
EU-hosted — all data is stored and processed in AWS
eu-west-1 (Ireland). No data leaves the European Union.GDPR Compliance
Dcycle acts as data processor under GDPR. Data processing agreements (DPAs) are available on request.
Backups & recovery
Backups & recovery
Automated daily backups with 7-day retention via AWS RDS automated snapshots. In case of accidental data deletion, contact contact@dcycle.io within 7 days with your organization ID and a description of the affected data.
Data deletion
Data deletion
Users can delete records at any time via the API or web application. Deleted records are removed from the primary database immediately. Backup copies are purged automatically after the 7-day retention window.
Infrastructure
Infrastructure
Dcycle runs on AWS (Amazon Web Services) with the following architecture:
- Compute: ECS Fargate (containerized, serverless)
- Database: RDS PostgreSQL (encrypted, private subnet)
- Storage: S3 (server-side encryption)
- Load balancing: Application Load Balancer with TLS termination
- Network: VPC with private subnets, no direct internet access to databases
Access Control
Dcycle uses organization-level access control with role-based permissions. Every API request is scoped to a single organization via thex-organization-id header.
Roles
| Role | Access Level | Typical Use |
|---|---|---|
| Admin | Full access to all resources and settings | Organization owners and managers |
| Member | Create, read, update, and delete data | Day-to-day data management |
| Viewer | Read-only access | Auditors, external reviewers |
Organization Isolation
- Users can only access organizations where they have an active membership
- Each API request is scoped to a single organization — cross-organization data access is not possible without explicit membership
- Parent organizations (holdings) can view aggregated data from subsidiaries when configured
Permission Model
Permissions are defined asresource:action pairs (e.g., facilities:create, vehicles:read). Available actions are: create, read, update, delete. Administrators can configure custom permission sets per role within their organization.
Logging & Auditability
What Is Logged
Every API request generates a structured log entry containing:| Field | Description |
|---|---|
| Timestamp | When the request was received |
| Method & Path | HTTP method and endpoint (e.g., POST /api/v1/logistics/requests) |
| Status Code | Response HTTP status |
| Organization ID | Which organization the request targeted |
| Client IP | Source IP address |
| Correlation ID | Unique identifier for request tracing |
| Process Time | Request processing duration |
User Attribution
All data created via API is linked to the user who owns the API key. Every record includes:created_by— the user who created the recordcreated_at— timestamp of creationupdated_at— timestamp of last modification
Request Tracing
Each API response includes tracing headers that can be provided to Dcycle support for incident investigation:Integration Patterns
The Dcycle API supports multiple integration approaches depending on your needs:| Pattern | Description | Typical Use Case |
|---|---|---|
| Manual | Ad-hoc API calls or web application use | One-time data uploads, exploration |
| Scheduled | Cron jobs, CI/CD pipelines, periodic scripts | Monthly reporting, data sync |
| Automated | Event-driven, real-time API integrations | ERP integration, continuous data feeds |
Network Requirements
The Dcycle API is a public HTTPS endpoint (
api.dcycle.io). No VPN, dedicated IP, firewall allowlisting, or special network configuration is required. Any environment with outbound HTTPS access (port 443) can connect.Rate Limits
Default rate limits apply to all API keys:| Limit | Value |
|---|---|
| Per organization | 1,000 requests/minute |
| Per API key | 50 requests/second |
X-RateLimit-Limit— maximum requests allowedX-RateLimit-Remaining— requests remaining in the current windowX-RateLimit-Reset— time until the limit resets
Incident Response
Reporting Security Issues
Report security concerns to contact@dcycle.io. Include as much detail as possible: what you observed, when it happened, and any relevant request/correlation IDs.Our Process
| Phase | Description |
|---|---|
| Detection | Automated monitoring and alerting across all infrastructure components |
| Triage | Security team assesses severity and impact |
| Notification | Affected customers notified within 72 hours per GDPR requirements |
| Resolution | Root cause analysis and remediation applied |
| Post-incident | Post-incident report provided to affected customers on request |
Dcycle continuously monitors infrastructure health, application performance, and security events using AWS CloudWatch, automated alerting, and log analysis.
Next Steps
Authentication
Set up API keys, CLI login, and MCP integration
API Reference
Explore all available endpoints
Support
Contact our team for questions